Replace Coldcard seeds generated with weak entropy

On August 18, 2026, the Roundtable synthesis identified Coldcard as the day’s most irreversible risk because weak entropy persists in an existing seed and every derived key.

The defense guidance states that corrected firmware affects future generation only, so waiting for an update does not remediate funds still controlled by a potentially affected seed.

The action can proceed now—inventory, replacement, offline recovery testing, and migration—even while the exact Coinkite model and firmware boundaries await confirmation from the missing authoritative advisory.

Coldcard Mk2/Mk3 holders whose seeds were created on firmware 4.0.1–4.1.9 may have weak-entropy seeds and derived keys; Mk2/Mk3 4.0.0 holders require conservative review because one investigation includes that version.

Coldcard Mk4/Mk5 holders whose seeds were created before 5.6.0 or Edge 6.6.0X face the same persistent seed-and-key exposure. Coldcard Q holders whose seeds were created before 1.5.0Q or Edge 6.6.0QX face the same exposure.

Holders relying on at least 50 independent private dice rolls or a strong, unique BIP-39 passphrase need evidence that they meet Coinkite’s authoritative qualification before excluding their seeds.

For each group, installing newer firmware does not change an existing seed; funds controlled by its derived keys remain the operational concern until migrated.

Support — The August 18, 2026 crypto-finance contribution reports that Coinkite’s advisory identifies Mk2/Mk3 firmware 4.0.1–4.1.9, Mk4/Mk5 before 5.6.0 or Edge 6.6.0X, and Q before 1.5.0Q or Edge 6.6.0QX as potentially affected; it also reports the dice-roll and BIP-39 passphrase qualifications and flags Mk2/Mk3 4.0.0 for conservative review.

Support — The defense architect states that affected seeds must be replaced on corrected or trusted hardware and funds migrated immediately because firmware cannot repair a seed already generated with weak entropy.

Support — The final synthesis identifies Coldcard as the day’s most irreversible risk and says affected seeds require replacement rather than patching alone.

Support — The evidence assessment confirms that the cited material directly supports inventorying creation-time firmware, creating a new seed, testing recovery offline, and migrating promptly.

Evidence gap — A separate evidence assessment finds that the authoritative vendor advisory is missing, so exact execution scope is not directly verified.

The crypto-finance analysis surfaced Coinkite’s reported firmware ranges, the dice-roll and BIP-39 passphrase qualifications, and the conflicting Mk2/Mk3 4.0.0 signal.

The defense architect converted that finding into an operational sequence: create a new seed on corrected or trusted hardware, verify recovery, and migrate funds because an update cannot repair an existing seed.

The evidence assessment supported that core sequence but found that the authoritative Coinkite advisory was absent, preventing direct verification of the exact boundaries. The boundary review therefore preserved the replacement action while requiring vendor confirmation of scope.

A linkage check found no prior Decision Record, and the arbiter selected a new operational decision because the missing advisory affects scope rather than the remediation logic.